The industry standard for the best peace of mind is for ALL dependencies to be pinned, both the lockfile and the dependencies.

Upgrades are done manually and all characters such as "^", "*", next to the version are removed for a fixed predictable version to avoid unexpected version bumps or package hijacked in-case if they are compromised.